CVE-2024-57760
📋 TL;DR
This SQL injection vulnerability in JeeWMS allows attackers to execute arbitrary SQL commands through the ReportId parameter. It affects all JeeWMS installations before version 2025.01.01, potentially compromising database integrity and confidentiality.
💻 Affected Systems
- JeeWMS
📦 What is this software?
Jeewms by Jeewms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, deletion, or potential remote code execution if database functions allow it.
Likely Case
Unauthorized data access, data manipulation, and potential privilege escalation within the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
SQL injection vulnerabilities are typically easy to exploit with basic knowledge of SQL and web requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.01.01
Vendor Advisory: https://gitee.com/erzhongxmu/JEEWMS/issues/IBFTVK
Restart Required: Yes
Instructions:
1. Download JeeWMS v2025.01.01 or later. 2. Backup current installation. 3. Replace affected files with patched version. 4. Restart the application server.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize ReportId parameter
Implement parameterized queries or prepared statements in CGReportDao.java
WAF Rule
allDeploy web application firewall rules to block SQL injection patterns
Configure WAF to detect and block SQL injection attempts on ReportId parameter
🧯 If You Can't Patch
- Implement network segmentation to restrict access to JeeWMS application
- Enable database auditing and monitoring for suspicious SQL queries
🔍 How to Verify
Check if Vulnerable:
Check JeeWMS version in application interface or configuration filesCheck Version:
Check application.properties or version.txt in JeeWMS installation directoryVerify Fix Applied:
Verify installation of v2025.01.01 or later and test ReportId parameter with SQL injection test payloads📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in application logs
Network Indicators:
- SQL keywords in HTTP POST/GET requests to /core/CGReportDao endpoints
SIEM Query:
source="*jeeWMS*" AND ("ReportId" AND ("UNION" OR "SELECT" OR "INSERT" OR "DELETE"))